You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@groovy.apache.org by su...@apache.org on 2021/11/28 16:44:38 UTC

[groovy] branch master updated: GROOVY-10393: Prepare for deprecation of security manager (JEP-411)

This is an automated email from the ASF dual-hosted git repository.

sunlan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/groovy.git


The following commit(s) were added to refs/heads/master by this push:
     new d6e5e54  GROOVY-10393: Prepare for deprecation of security manager (JEP-411)
d6e5e54 is described below

commit d6e5e54b4a0559178d45d7a1b5d6d47b5974817d
Author: Paul King <pa...@asert.com.au>
AuthorDate: Sun Nov 28 21:50:23 2021 +1000

    GROOVY-10393: Prepare for deprecation of security manager (JEP-411)
---
 src/main/java/groovy/grape/Grape.java              |  5 ++--
 src/main/java/groovy/lang/GroovyClassLoader.java   | 14 ++++-----
 src/main/java/groovy/lang/GroovyCodeSource.java    |  4 +--
 src/main/java/groovy/lang/GroovyShell.java         | 16 +++++-----
 src/main/java/groovy/lang/MetaClassImpl.java       |  5 ++--
 src/main/java/groovy/ui/GroovyMain.java            |  4 +--
 src/main/java/groovy/util/GroovyScriptEngine.java  |  6 ++--
 .../internal/util/ReevaluatingReference.java       |  4 +--
 .../codehaus/groovy/control/ProcessingUnit.java    |  4 +--
 .../org/codehaus/groovy/control/SourceUnit.java    |  4 +--
 .../codehaus/groovy/reflection/CachedClass.java    | 10 +++----
 .../org/codehaus/groovy/reflection/ClassInfo.java  |  3 +-
 .../reflection/ClassLoaderForClassArtifacts.java   |  4 +--
 .../groovy/reflection/ReflectionUtils.java         |  3 +-
 .../codehaus/groovy/reflection/SunClassLoader.java |  4 +--
 .../reflection/stdclasses/CachedSAMClass.java      |  4 +--
 .../groovy/runtime/DefaultGroovyMethods.java       |  4 +--
 .../groovy/runtime/ProxyGeneratorAdapter.java      |  4 +--
 .../groovy/runtime/callsite/CallSiteArray.java     |  5 ++--
 .../runtime/callsite/GroovySunClassLoader.java     |  4 +--
 .../org/codehaus/groovy/tools/GroovyStarter.java   |  5 ++--
 .../groovy/tools/javac/JavacJavaCompiler.java      |  4 +--
 .../org/codehaus/groovy/vmplugin/VMPlugin.java     | 24 +++++++++++++++
 .../org/codehaus/groovy/vmplugin/v8/Java8.java     | 12 ++++++++
 src/test/groovy/security/SecurityTest.java         |  4 +--
 src/test/groovy/security/SecurityTestSupport.java  | 12 ++++----
 .../apache/groovy/parser/antlr4/TestUtils.groovy   |  6 ++--
 .../org/codehaus/groovy/classgen/TestSupport.java  |  6 ++--
 .../codehaus/groovy/ant/CompileTaskSupport.java    |  4 +--
 .../main/java/org/codehaus/groovy/ant/Groovy.java  |  4 +--
 .../main/java/org/codehaus/groovy/ant/Groovyc.java |  4 +--
 .../org/codehaus/groovy/ant/RootLoaderRef.java     |  4 +--
 .../main/groovy/groovy/console/ui/Console.groovy   | 14 ---------
 .../console/ui/text/StructuredSyntaxResources.java | 34 ++++++++++++----------
 .../groovy/jsr223/GroovyScriptEngineImpl.java      |  4 +--
 .../groovy-sql/src/main/java/groovy/sql/Sql.java   |  4 +--
 .../swing/binding/ClosureTriggerBinding.java       |  3 +-
 .../groovy/groovy/text/GStringTemplateEngine.java  |  4 +--
 .../groovy/text/StreamingTemplateEngine.java       |  4 +--
 .../groovy/text/markup/MarkupTemplateEngine.java   |  6 ++--
 .../src/main/java/groovy/test/AllTestSuite.java    |  4 +--
 .../src/main/java/groovy/test/GroovyTestSuite.java |  5 ++--
 .../src/main/java/groovy/xml/FactorySupport.java   |  5 ++--
 43 files changed, 156 insertions(+), 131 deletions(-)

diff --git a/src/main/java/groovy/grape/Grape.java b/src/main/java/groovy/grape/Grape.java
index a8dcc88..d3e9289 100644
--- a/src/main/java/groovy/grape/Grape.java
+++ b/src/main/java/groovy/grape/Grape.java
@@ -18,9 +18,10 @@
  */
 package groovy.grape;
 
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
+
 import java.lang.reflect.InvocationTargetException;
 import java.net.URI;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Collections;
 import java.util.List;
@@ -157,7 +158,7 @@ public class Grape {
 
     public static void grab(final Map<String, Object> args, final Map... dependencies) {
         if (enableGrapes) {
-            AccessController.doPrivileged(new PrivilegedAction<Void>() {
+            VMPluginFactory.getPlugin().doPrivileged(new PrivilegedAction<Void>() {
                 @Override
                 public Void run() {
                     GrapeEngine instance = getInstance();
diff --git a/src/main/java/groovy/lang/GroovyClassLoader.java b/src/main/java/groovy/lang/GroovyClassLoader.java
index ce76e65..704d5f7 100644
--- a/src/main/java/groovy/lang/GroovyClassLoader.java
+++ b/src/main/java/groovy/lang/GroovyClassLoader.java
@@ -49,6 +49,7 @@ import org.codehaus.groovy.runtime.memoize.EvictableCache;
 import org.codehaus.groovy.runtime.memoize.StampedCommonCache;
 import org.codehaus.groovy.runtime.memoize.UnlimitedConcurrentCache;
 import org.codehaus.groovy.util.URLStreams;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassVisitor;
 import org.objectweb.asm.ClassWriter;
 import org.objectweb.asm.Opcodes;
@@ -66,7 +67,6 @@ import java.net.URL;
 import java.net.URLClassLoader;
 import java.net.URLConnection;
 import java.net.URLDecoder;
-import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.NoSuchAlgorithmException;
 import java.security.Permission;
@@ -111,7 +111,7 @@ public class GroovyClassLoader extends URLClassLoader {
     private GroovyResourceLoader resourceLoader = new GroovyResourceLoader() {
         @Override
         public URL loadGroovySource(final String filename) throws MalformedURLException {
-            return AccessController.doPrivileged((PrivilegedAction<URL>) () -> {
+            return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<URL>) () -> {
                 for (String extension : config.getScriptExtensions()) {
                     try {
                         URL ret = getSourceFile(filename, extension);
@@ -253,7 +253,7 @@ public class GroovyClassLoader extends URLClassLoader {
      * @return the main class defined in the given script
      */
     public Class parseClass(final String text, final String fileName) throws CompilationFailedException {
-        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(text, fileName, "/groovy/script"));
+        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(text, fileName, "/groovy/script"));
         gcs.setCachable(false);
         return parseClass(gcs);
     }
@@ -278,7 +278,7 @@ public class GroovyClassLoader extends URLClassLoader {
     }
 
     public Class parseClass(final Reader reader, final String fileName) throws CompilationFailedException {
-        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> {
+        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> {
             try {
                 String scriptText = IOGroovyMethods.getText(reader);
                 return new GroovyCodeSource(scriptText, fileName, "/groovy/script");
@@ -425,7 +425,7 @@ public class GroovyClassLoader extends URLClassLoader {
                 perms = new Permissions();
             }
 
-            ProtectionDomain myDomain = AccessController.doPrivileged(new PrivilegedAction<ProtectionDomain>() {
+            ProtectionDomain myDomain = VMPluginFactory.getPlugin().doPrivileged(new PrivilegedAction<ProtectionDomain>() {
                 @Override
                 public ProtectionDomain run() {
                     return getClass().getProtectionDomain();
@@ -643,7 +643,7 @@ public class GroovyClassLoader extends URLClassLoader {
      * @return the ClassCollector
      */
     protected ClassCollector createCollector(CompilationUnit unit, SourceUnit su) {
-        InnerLoader loader = AccessController.doPrivileged((PrivilegedAction<InnerLoader>) () -> new InnerLoader(GroovyClassLoader.this));
+        InnerLoader loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<InnerLoader>) () -> new InnerLoader(GroovyClassLoader.this));
         return new ClassCollector(loader, unit, su);
     }
 
@@ -1082,7 +1082,7 @@ public class GroovyClassLoader extends URLClassLoader {
      * @see #addURL(URL)
      */
     public void addClasspath(final String path) {
-        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
 
             URI newURI;
             try {
diff --git a/src/main/java/groovy/lang/GroovyCodeSource.java b/src/main/java/groovy/lang/GroovyCodeSource.java
index 6d6bfd2..721c555 100644
--- a/src/main/java/groovy/lang/GroovyCodeSource.java
+++ b/src/main/java/groovy/lang/GroovyCodeSource.java
@@ -22,6 +22,7 @@ import groovy.security.GroovyCodeSourcePermission;
 import groovy.util.CharsetToolkit;
 import org.codehaus.groovy.runtime.IOGroovyMethods;
 import org.codehaus.groovy.runtime.ResourceGroovyMethods;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.FileNotFoundException;
@@ -31,7 +32,6 @@ import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URL;
 import java.net.URLConnection;
-import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
@@ -123,7 +123,7 @@ public class GroovyCodeSource {
         //The calls below require access to user.dir - allow here since getName() and getCodeSource() are
         //package private and used only by the GroovyClassLoader.
         try {
-            Object[] info = AccessController.doPrivileged((PrivilegedExceptionAction<Object[]>) () -> {
+            Object[] info = VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction<Object[]>) () -> {
                 // retrieve the content of the file using the provided encoding
                 if (encoding != null) {
                     scriptText = ResourceGroovyMethods.getText(infile, encoding);
diff --git a/src/main/java/groovy/lang/GroovyShell.java b/src/main/java/groovy/lang/GroovyShell.java
index 8cc43dd..2efc40c 100644
--- a/src/main/java/groovy/lang/GroovyShell.java
+++ b/src/main/java/groovy/lang/GroovyShell.java
@@ -26,6 +26,7 @@ import org.codehaus.groovy.control.CompilationFailedException;
 import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.runtime.InvokerHelper;
 import org.codehaus.groovy.runtime.InvokerInvocationException;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
@@ -33,7 +34,6 @@ import java.io.Reader;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.net.URI;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
@@ -100,7 +100,7 @@ public class GroovyShell extends GroovyObjectSupport {
             && ((GroovyClassLoader) parentLoader).hasCompatibleConfiguration(config)) {
           this.loader = (GroovyClassLoader) parentLoader;
         } else {
-          this.loader = AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader,config));
+          this.loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader,config));
         }
         this.context = binding;
         this.config = config;
@@ -203,13 +203,13 @@ public class GroovyShell extends GroovyObjectSupport {
             }
         }
 
-        AccessController.doPrivileged(new DoSetContext(loader));
+        VMPluginFactory.getPlugin().doPrivileged(new DoSetContext(loader));
 
         // Parse the script, generate the class, and invoke the main method.  This is a little looser than
         // if you are compiling the script because the JVM isn't executing the main method.
         Class scriptClass;
         try {
-            scriptClass = AccessController.doPrivileged((PrivilegedExceptionAction<Class>) () -> loader.parseClass(scriptFile));
+            scriptClass = VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction<Class>) () -> loader.parseClass(scriptFile));
         } catch (PrivilegedActionException pae) {
             Exception e = pae.getException();
             if (e instanceof CompilationFailedException) {
@@ -340,7 +340,7 @@ public class GroovyShell extends GroovyObjectSupport {
      * @param args       the command line arguments to pass in
      */
     public Object run(final String scriptText, final String fileName, String[] args) throws CompilationFailedException {
-        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, DEFAULT_CODE_BASE));
+        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, DEFAULT_CODE_BASE));
         return run(gcs, args);
     }
 
@@ -404,7 +404,7 @@ public class GroovyShell extends GroovyObjectSupport {
      * @param args     the command line arguments to pass in
      */
     public Object run(final Reader in, final String fileName, String[] args) throws CompilationFailedException {
-        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(in, fileName, DEFAULT_CODE_BASE));
+        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(in, fileName, DEFAULT_CODE_BASE));
         Class scriptClass = parseClass(gcs);
         return runScriptOrMainOrTestOrRunnable(scriptClass, args);
     }
@@ -461,7 +461,7 @@ public class GroovyShell extends GroovyObjectSupport {
             sm.checkPermission(new GroovyCodeSourcePermission(codeBase));
         }
 
-        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, codeBase));
+        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, codeBase));
 
         return evaluate(gcs);
     }
@@ -606,7 +606,7 @@ public class GroovyShell extends GroovyObjectSupport {
     }
 
     public Script parse(final String scriptText, final String fileName, Binding binding) throws CompilationFailedException {
-        GroovyCodeSource gcs = AccessController.doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, DEFAULT_CODE_BASE));
+        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(scriptText, fileName, DEFAULT_CODE_BASE));
         return parse(gcs, binding);
     }
 
diff --git a/src/main/java/groovy/lang/MetaClassImpl.java b/src/main/java/groovy/lang/MetaClassImpl.java
index 21d3799..fcc55c5 100644
--- a/src/main/java/groovy/lang/MetaClassImpl.java
+++ b/src/main/java/groovy/lang/MetaClassImpl.java
@@ -96,7 +96,6 @@ import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.lang.reflect.Proxy;
 import java.net.URL;
-import java.security.AccessController;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 import java.util.ArrayList;
@@ -3590,9 +3589,9 @@ public class MetaClassImpl implements MetaClass, MutableMetaClass {
         //     introspect
         try {
             if (isBeanDerivative(theClass)) {
-                info = (BeanInfo) AccessController.doPrivileged((PrivilegedExceptionAction) () -> Introspector.getBeanInfo(theClass, Introspector.IGNORE_ALL_BEANINFO));
+                info = (BeanInfo) VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction) () -> Introspector.getBeanInfo(theClass, Introspector.IGNORE_ALL_BEANINFO));
             } else {
-                info = (BeanInfo) AccessController.doPrivileged((PrivilegedExceptionAction) () -> Introspector.getBeanInfo(theClass));
+                info = (BeanInfo) VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction) () -> Introspector.getBeanInfo(theClass));
             }
         } catch (PrivilegedActionException pae) {
             throw new GroovyRuntimeException("exception during bean introspection", pae.getException());
diff --git a/src/main/java/groovy/ui/GroovyMain.java b/src/main/java/groovy/ui/GroovyMain.java
index 752fd62..a78cc93 100644
--- a/src/main/java/groovy/ui/GroovyMain.java
+++ b/src/main/java/groovy/ui/GroovyMain.java
@@ -33,6 +33,7 @@ import org.codehaus.groovy.runtime.InvokerInvocationException;
 import org.codehaus.groovy.runtime.ResourceGroovyMethods;
 import org.codehaus.groovy.runtime.StackTraceUtils;
 import org.codehaus.groovy.runtime.StringGroovyMethods;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import picocli.CommandLine;
 import picocli.CommandLine.Command;
 import picocli.CommandLine.IVersionProvider;
@@ -54,7 +55,6 @@ import java.math.BigInteger;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -527,7 +527,7 @@ public class GroovyMain {
             }
         }
 
-        AccessController.doPrivileged(new DoSetContext(shell.getClassLoader()));
+        VMPluginFactory.getPlugin().doPrivileged(new DoSetContext(shell.getClassLoader()));
     }
 
     /**
diff --git a/src/main/java/groovy/util/GroovyScriptEngine.java b/src/main/java/groovy/util/GroovyScriptEngine.java
index f4bbd58..f80d771 100644
--- a/src/main/java/groovy/util/GroovyScriptEngine.java
+++ b/src/main/java/groovy/util/GroovyScriptEngine.java
@@ -37,6 +37,7 @@ import org.codehaus.groovy.runtime.IOGroovyMethods;
 import org.codehaus.groovy.runtime.InvokerHelper;
 import org.codehaus.groovy.tools.gse.DependencyTracker;
 import org.codehaus.groovy.tools.gse.StringSetMap;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.BufferedReader;
 import java.io.File;
@@ -47,7 +48,6 @@ import java.lang.ref.WeakReference;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLConnection;
-import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.PrivilegedAction;
 import java.util.HashMap;
@@ -61,7 +61,7 @@ import java.util.concurrent.ConcurrentHashMap;
  * with dependent scripts.
  */
 public class GroovyScriptEngine implements ResourceConnector {
-    private static final ClassLoader CL_STUB = AccessController.doPrivileged((PrivilegedAction<ClassLoader>) () -> new ClassLoader() {});
+    private static final ClassLoader CL_STUB = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<ClassLoader>) () -> new ClassLoader() {});
 
     private static final URL[] EMPTY_URL_ARRAY = new URL[0];
 
@@ -339,7 +339,7 @@ public class GroovyScriptEngine implements ResourceConnector {
      */
     private GroovyClassLoader initGroovyLoader() {
         GroovyClassLoader groovyClassLoader =
-                AccessController.doPrivileged((PrivilegedAction<ScriptClassLoader>) () -> {
+                VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<ScriptClassLoader>) () -> {
                     if (parentLoader instanceof GroovyClassLoader) {
                         return new ScriptClassLoader((GroovyClassLoader) parentLoader);
                     } else {
diff --git a/src/main/java/org/apache/groovy/internal/util/ReevaluatingReference.java b/src/main/java/org/apache/groovy/internal/util/ReevaluatingReference.java
index 255e97b..3010f05 100644
--- a/src/main/java/org/apache/groovy/internal/util/ReevaluatingReference.java
+++ b/src/main/java/org/apache/groovy/internal/util/ReevaluatingReference.java
@@ -21,13 +21,13 @@ package org.apache.groovy.internal.util;
 
 import org.apache.groovy.lang.annotation.Incubating;
 import org.codehaus.groovy.GroovyBugError;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.lang.invoke.MethodHandle;
 import java.lang.invoke.MethodHandles;
 import java.lang.invoke.MethodType;
 import java.lang.invoke.SwitchPoint;
 import java.lang.ref.WeakReference;
-import java.security.AccessController;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 
@@ -41,7 +41,7 @@ public class ReevaluatingReference<T> {
     static {
         try {
             //TODO Jochen: move the findSpecial to a central place together with others to easy security configuration
-            FALLBACK_HANDLE = AccessController.doPrivileged((PrivilegedExceptionAction<MethodHandle>) () -> MethodHandles.lookup().findSpecial(
+            FALLBACK_HANDLE = VMPluginFactory.getPlugin().doPrivileged((PrivilegedExceptionAction<MethodHandle>) () -> MethodHandles.lookup().findSpecial(
                     ReevaluatingReference.class, "replacePayLoad",
                     MethodType.methodType(Object.class),
                     ReevaluatingReference.class));
diff --git a/src/main/java/org/codehaus/groovy/control/ProcessingUnit.java b/src/main/java/org/codehaus/groovy/control/ProcessingUnit.java
index 0b12ebf..25ba755 100644
--- a/src/main/java/org/codehaus/groovy/control/ProcessingUnit.java
+++ b/src/main/java/org/codehaus/groovy/control/ProcessingUnit.java
@@ -19,8 +19,8 @@
 package org.codehaus.groovy.control;
 
 import groovy.lang.GroovyClassLoader;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 import static java.util.Objects.requireNonNull;
@@ -100,7 +100,7 @@ public abstract class ProcessingUnit {
     public void setClassLoader(final GroovyClassLoader loader) {
         // ClassLoaders should only be created inside a doPrivileged block in case
         // this method is invoked by code that does not have security permissions.
-        this.classLoader = loader != null ? loader : AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> {
+        this.classLoader = loader != null ? loader : VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> {
             ClassLoader parent = Thread.currentThread().getContextClassLoader();
             if (parent == null) parent = ProcessingUnit.class.getClassLoader();
             return new GroovyClassLoader(parent, getConfiguration());
diff --git a/src/main/java/org/codehaus/groovy/control/SourceUnit.java b/src/main/java/org/codehaus/groovy/control/SourceUnit.java
index 360cb26..72c8db0 100644
--- a/src/main/java/org/codehaus/groovy/control/SourceUnit.java
+++ b/src/main/java/org/codehaus/groovy/control/SourceUnit.java
@@ -31,12 +31,12 @@ import org.codehaus.groovy.control.messages.SyntaxErrorMessage;
 import org.codehaus.groovy.syntax.Reduction;
 import org.codehaus.groovy.syntax.SyntaxException;
 import org.codehaus.groovy.tools.Utilities;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
 import java.io.Reader;
 import java.net.URL;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -236,7 +236,7 @@ public class SourceUnit extends ProcessingUnit {
 
         buildAST();
 
-        if ("xml".equals(AccessController.doPrivileged((PrivilegedAction<String>) () -> System.getProperty("groovy.ast")))) {
+        if ("xml".equals(VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<String>) () -> System.getProperty("groovy.ast")))) {
             XStreamUtils.serialize(name, ast);
         }
     }
diff --git a/src/main/java/org/codehaus/groovy/reflection/CachedClass.java b/src/main/java/org/codehaus/groovy/reflection/CachedClass.java
index 63ea5a0..8517820 100644
--- a/src/main/java/org/codehaus/groovy/reflection/CachedClass.java
+++ b/src/main/java/org/codehaus/groovy/reflection/CachedClass.java
@@ -30,8 +30,8 @@ import org.codehaus.groovy.runtime.metaclass.ClosureMetaClass;
 import org.codehaus.groovy.util.FastArray;
 import org.codehaus.groovy.util.LazyReference;
 import org.codehaus.groovy.util.ReferenceBundle;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -57,7 +57,7 @@ public class CachedClass {
             PrivilegedAction<CachedField[]> action = () -> Arrays.stream(getTheClass().getDeclaredFields())
                 .filter(f -> ReflectionUtils.checkCanSetAccessible(f, CachedClass.class))
                 .map(CachedField::new).toArray(CachedField[]::new);
-            return AccessController.doPrivileged(action);
+            return VMPluginFactory.getPlugin().doPrivileged(action);
         }
     };
 
@@ -71,7 +71,7 @@ public class CachedClass {
                 .filter(c -> ReflectionUtils.checkCanSetAccessible(c, CachedClass.class))
                 .map(c -> new CachedConstructor(CachedClass.this, c))
                 .toArray(CachedConstructor[]::new);
-            return AccessController.doPrivileged(action);
+            return VMPluginFactory.getPlugin().doPrivileged(action);
         }
     };
 
@@ -92,7 +92,7 @@ public class CachedClass {
                     return CachedMethod.EMPTY_ARRAY;
                 }
             };
-            CachedMethod[] declaredMethods = AccessController.doPrivileged(action);
+            CachedMethod[] declaredMethods = VMPluginFactory.getPlugin().doPrivileged(action);
 
             List<CachedMethod> methods = new ArrayList<>(declaredMethods.length);
             List<CachedMethod> mopMethods = new ArrayList<>(declaredMethods.length);
@@ -140,7 +140,7 @@ public class CachedClass {
 
         @Override
         public CallSiteClassLoader initValue() {
-            return AccessController.doPrivileged((PrivilegedAction<CallSiteClassLoader>) () -> new CallSiteClassLoader(CachedClass.this.cachedClass));
+            return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<CallSiteClassLoader>) () -> new CallSiteClassLoader(CachedClass.this.cachedClass));
         }
     };
 
diff --git a/src/main/java/org/codehaus/groovy/reflection/ClassInfo.java b/src/main/java/org/codehaus/groovy/reflection/ClassInfo.java
index b4b4f6d..f5faf72 100644
--- a/src/main/java/org/codehaus/groovy/reflection/ClassInfo.java
+++ b/src/main/java/org/codehaus/groovy/reflection/ClassInfo.java
@@ -54,7 +54,6 @@ import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import java.lang.ref.WeakReference;
 import java.math.BigDecimal;
 import java.math.BigInteger;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Collection;
 import java.util.Iterator;
@@ -450,7 +449,7 @@ public class ClassInfo implements Finalizable {
 
         @Override
         public ClassLoaderForClassArtifacts initValue() {
-            return AccessController.doPrivileged((PrivilegedAction<ClassLoaderForClassArtifacts>) () -> new ClassLoaderForClassArtifacts(info.classRef.get()));
+            return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<ClassLoaderForClassArtifacts>) () -> new ClassLoaderForClassArtifacts(info.classRef.get()));
         }
     }
 
diff --git a/src/main/java/org/codehaus/groovy/reflection/ClassLoaderForClassArtifacts.java b/src/main/java/org/codehaus/groovy/reflection/ClassLoaderForClassArtifacts.java
index 4995c58..e01ee59 100644
--- a/src/main/java/org/codehaus/groovy/reflection/ClassLoaderForClassArtifacts.java
+++ b/src/main/java/org/codehaus/groovy/reflection/ClassLoaderForClassArtifacts.java
@@ -22,11 +22,11 @@ import groovy.lang.MetaClassImpl;
 import groovy.lang.MetaMethod;
 import org.codehaus.groovy.runtime.callsite.CallSite;
 import org.codehaus.groovy.runtime.callsite.GroovySunClassLoader;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.lang.ref.SoftReference;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Method;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.concurrent.atomic.AtomicInteger;
 
@@ -76,7 +76,7 @@ public class ClassLoaderForClassArtifacts extends ClassLoader {
     }
 
     public Constructor defineClassAndGetConstructor(final String name, final byte[] bytes) {
-        final Class cls = AccessController.doPrivileged((PrivilegedAction<Class>) () -> define(name, bytes));
+        final Class cls = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Class>) () -> define(name, bytes));
 
         if (cls != null) {
             try {
diff --git a/src/main/java/org/codehaus/groovy/reflection/ReflectionUtils.java b/src/main/java/org/codehaus/groovy/reflection/ReflectionUtils.java
index dccab1f..13d29ab 100644
--- a/src/main/java/org/codehaus/groovy/reflection/ReflectionUtils.java
+++ b/src/main/java/org/codehaus/groovy/reflection/ReflectionUtils.java
@@ -28,7 +28,6 @@ import java.lang.invoke.MethodType;
 import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Array;
 import java.lang.reflect.Method;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -207,7 +206,7 @@ public class ReflectionUtils {
     }
 
     public static Optional<AccessibleObject> makeAccessibleInPrivilegedAction(final AccessibleObject ao) {
-        return AccessController.doPrivileged((PrivilegedAction<Optional<AccessibleObject>>) () -> makeAccessible(ao));
+        return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Optional<AccessibleObject>>) () -> makeAccessible(ao));
     }
 
     // to be run in PrivilegedAction!
diff --git a/src/main/java/org/codehaus/groovy/reflection/SunClassLoader.java b/src/main/java/org/codehaus/groovy/reflection/SunClassLoader.java
index 2c78c96..e1c6a57 100644
--- a/src/main/java/org/codehaus/groovy/reflection/SunClassLoader.java
+++ b/src/main/java/org/codehaus/groovy/reflection/SunClassLoader.java
@@ -19,13 +19,13 @@
 package org.codehaus.groovy.reflection;
 
 import org.codehaus.groovy.control.CompilerConfiguration;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassReader;
 import org.objectweb.asm.ClassWriter;
 import org.objectweb.asm.MethodVisitor;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.HashMap;
 import java.util.Map;
@@ -46,7 +46,7 @@ public class SunClassLoader extends ClassLoader {
     static {
         SunClassLoader res;
         try {
-            res = AccessController.doPrivileged((PrivilegedAction<SunClassLoader>) () -> {
+            res = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<SunClassLoader>) () -> {
                 try {
                     return new SunClassLoader();
                 } catch (Throwable e) {
diff --git a/src/main/java/org/codehaus/groovy/reflection/stdclasses/CachedSAMClass.java b/src/main/java/org/codehaus/groovy/reflection/stdclasses/CachedSAMClass.java
index 5ab7ac7..d131a98 100644
--- a/src/main/java/org/codehaus/groovy/reflection/stdclasses/CachedSAMClass.java
+++ b/src/main/java/org/codehaus/groovy/reflection/stdclasses/CachedSAMClass.java
@@ -26,11 +26,11 @@ import org.codehaus.groovy.reflection.ClassInfo;
 import org.codehaus.groovy.reflection.ReflectionCache;
 import org.codehaus.groovy.runtime.ConvertedClosure;
 import org.codehaus.groovy.transform.trait.Traits;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
 import java.lang.reflect.Proxy;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Arrays;
 import java.util.Collections;
@@ -102,7 +102,7 @@ public class CachedSAMClass extends CachedClass {
 
     private static Method[] getDeclaredMethods(final Class c) {
         try {
-            Method[] methods = AccessController.doPrivileged((PrivilegedAction<Method[]>) c::getDeclaredMethods);
+            Method[] methods = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Method[]>) c::getDeclaredMethods);
             if (methods!=null) return methods;
         } catch (java.security.AccessControlException ace) {
             // swallow and do as if no method is available
diff --git a/src/main/java/org/codehaus/groovy/runtime/DefaultGroovyMethods.java b/src/main/java/org/codehaus/groovy/runtime/DefaultGroovyMethods.java
index e0163d0..7283925 100644
--- a/src/main/java/org/codehaus/groovy/runtime/DefaultGroovyMethods.java
+++ b/src/main/java/org/codehaus/groovy/runtime/DefaultGroovyMethods.java
@@ -108,6 +108,7 @@ import org.codehaus.groovy.util.ListBufferedIterator;
 import org.codehaus.groovy.util.LongArrayIterable;
 import org.codehaus.groovy.util.LongArrayIterator;
 import org.codehaus.groovy.util.ShortArrayIterator;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -124,7 +125,6 @@ import java.math.BigDecimal;
 import java.math.BigInteger;
 import java.math.RoundingMode;
 import java.net.URL;
-import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.PrivilegedAction;
 import java.text.MessageFormat;
@@ -461,7 +461,7 @@ public class DefaultGroovyMethods extends DefaultGroovyMethodsSupport {
                     if (groovyObject && field.getName().equals("metaClass")) {
                         continue;
                     }
-                    AccessController.doPrivileged((PrivilegedAction<Object>) () -> {
+                    VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Object>) () -> {
                         ReflectionUtils.trySetAccessible(field);
                         return null;
                     });
diff --git a/src/main/java/org/codehaus/groovy/runtime/ProxyGeneratorAdapter.java b/src/main/java/org/codehaus/groovy/runtime/ProxyGeneratorAdapter.java
index 9821da3..3dc107e 100644
--- a/src/main/java/org/codehaus/groovy/runtime/ProxyGeneratorAdapter.java
+++ b/src/main/java/org/codehaus/groovy/runtime/ProxyGeneratorAdapter.java
@@ -35,6 +35,7 @@ import org.codehaus.groovy.control.Phases;
 import org.codehaus.groovy.control.SourceUnit;
 import org.codehaus.groovy.tools.GroovyClass;
 import org.codehaus.groovy.transform.trait.Traits;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassVisitor;
 import org.objectweb.asm.ClassWriter;
 import org.objectweb.asm.Label;
@@ -46,7 +47,6 @@ import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -286,7 +286,7 @@ public class ProxyGeneratorAdapter extends ClassVisitor {
     }
 
     private static InnerLoader createInnerLoader(final ClassLoader parent, final Class[] interfaces) {
-        return AccessController.doPrivileged((PrivilegedAction<InnerLoader>) () -> new InnerLoader(parent, interfaces));
+        return VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<InnerLoader>) () -> new InnerLoader(parent, interfaces));
     }
 
     private InnerLoader findClassLoader(Class clazz, Class[] interfaces) {
diff --git a/src/main/java/org/codehaus/groovy/runtime/callsite/CallSiteArray.java b/src/main/java/org/codehaus/groovy/runtime/callsite/CallSiteArray.java
index 5fe58fb..22de80c 100644
--- a/src/main/java/org/codehaus/groovy/runtime/callsite/CallSiteArray.java
+++ b/src/main/java/org/codehaus/groovy/runtime/callsite/CallSiteArray.java
@@ -25,12 +25,11 @@ import groovy.lang.MetaClassImpl;
 import org.codehaus.groovy.reflection.ClassInfo;
 import org.codehaus.groovy.runtime.GroovyCategorySupport;
 import org.codehaus.groovy.runtime.InvokerHelper;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.stream.IntStream;
 
-
 public final class CallSiteArray {
     public static final Object[] NOPARAM = new Object[0];
     public final CallSite[] array;
@@ -60,7 +59,7 @@ public final class CallSiteArray {
     }
 
     private static CallSite createCallStaticSite(CallSite callSite, final Class receiver, Object[] args) {
-        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
             try {
                 Class.forName(receiver.getName(), true, receiver.getClassLoader());
             } catch (Exception e) {
diff --git a/src/main/java/org/codehaus/groovy/runtime/callsite/GroovySunClassLoader.java b/src/main/java/org/codehaus/groovy/runtime/callsite/GroovySunClassLoader.java
index 40ae164..a4ccd09 100644
--- a/src/main/java/org/codehaus/groovy/runtime/callsite/GroovySunClassLoader.java
+++ b/src/main/java/org/codehaus/groovy/runtime/callsite/GroovySunClassLoader.java
@@ -20,13 +20,13 @@ package org.codehaus.groovy.runtime.callsite;
 
 import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.reflection.SunClassLoader;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassReader;
 import org.objectweb.asm.ClassVisitor;
 import org.objectweb.asm.ClassWriter;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 public class GroovySunClassLoader extends SunClassLoader {
@@ -34,7 +34,7 @@ public class GroovySunClassLoader extends SunClassLoader {
     public static final SunClassLoader sunVM;
 
     static {
-        sunVM = AccessController.doPrivileged((PrivilegedAction<SunClassLoader>) () -> {
+        sunVM = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<SunClassLoader>) () -> {
             try {
                 if (SunClassLoader.sunVM != null) {
                     return new GroovySunClassLoader();
diff --git a/src/main/java/org/codehaus/groovy/tools/GroovyStarter.java b/src/main/java/org/codehaus/groovy/tools/GroovyStarter.java
index 4bffd72..21e7001 100644
--- a/src/main/java/org/codehaus/groovy/tools/GroovyStarter.java
+++ b/src/main/java/org/codehaus/groovy/tools/GroovyStarter.java
@@ -18,10 +18,11 @@
  */
 package org.codehaus.groovy.tools;
 
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
+
 import java.io.FileInputStream;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -99,7 +100,7 @@ public class GroovyStarter {
             }
         }
         // create loader and execute main class
-        ClassLoader loader = AccessController.doPrivileged((PrivilegedAction<RootLoader>) () -> new RootLoader(lc));
+        ClassLoader loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<RootLoader>) () -> new RootLoader(lc));
         Method m=null;
         try {
             Class c = loader.loadClass(lc.getMainClass());
diff --git a/src/main/java/org/codehaus/groovy/tools/javac/JavacJavaCompiler.java b/src/main/java/org/codehaus/groovy/tools/javac/JavacJavaCompiler.java
index c654cdf..1e66bcc 100644
--- a/src/main/java/org/codehaus/groovy/tools/javac/JavacJavaCompiler.java
+++ b/src/main/java/org/codehaus/groovy/tools/javac/JavacJavaCompiler.java
@@ -27,6 +27,7 @@ import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.control.messages.ExceptionMessage;
 import org.codehaus.groovy.control.messages.SimpleMessage;
 import org.codehaus.groovy.runtime.DefaultGroovyMethods;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
@@ -34,7 +35,6 @@ import java.net.URISyntaxException;
 import java.net.URL;
 import java.net.URLClassLoader;
 import java.nio.charset.Charset;
-import java.security.AccessController;
 import java.security.CodeSource;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
@@ -189,7 +189,7 @@ public class JavacJavaCompiler implements JavaCompiler {
             }
 
             try {
-                CodeSource codeSource = AccessController.doPrivileged(
+                CodeSource codeSource = VMPluginFactory.getPlugin().doPrivileged(
                         (PrivilegedAction<CodeSource>) () -> GroovyObject.class.getProtectionDomain().getCodeSource());
                 if (codeSource != null) {
                     paths.add(new File(codeSource.getLocation().toURI()).getPath());
diff --git a/src/main/java/org/codehaus/groovy/vmplugin/VMPlugin.java b/src/main/java/org/codehaus/groovy/vmplugin/VMPlugin.java
index 2aa654c..921de89 100644
--- a/src/main/java/org/codehaus/groovy/vmplugin/VMPlugin.java
+++ b/src/main/java/org/codehaus/groovy/vmplugin/VMPlugin.java
@@ -29,6 +29,10 @@ import java.lang.invoke.MethodHandle;
 import java.lang.invoke.MethodHandles;
 import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Method;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.Collections;
 import java.util.Map;
 import java.util.Set;
@@ -139,6 +143,26 @@ public interface VMPlugin {
     MetaMethod transformMetaMethod(MetaClass metaClass, MetaMethod metaMethod, Class<?> caller);
 
     /**
+     * Performs the specified PrivilegedAction with privileges enabled on platforms
+     * which support that capability, otherwise the action is performed ignoring privileges.
+     *
+     * @param action the action to be performed
+     * @param <T> the type of the value returned by the PrivilegedAction's run method
+     * @return the value returned by the action's run method
+     */
+    <T> T doPrivileged(PrivilegedAction<T> action);
+
+    /**
+     * Performs the specified PrivilegedExceptionAction with privileges enabled on platforms
+     * which support that capability, otherwise the action is performed ignoring privileges.
+     *
+     * @param action the action to be performed
+     * @param <T> the type of the value returned by the PrivilegedAction's run method
+     * @return the value returned by the action's run method
+     */
+    <T> T doPrivileged(PrivilegedExceptionAction<T> action) throws PrivilegedActionException;
+
+    /**
      * transform meta method.
      *
      * @param metaClass meta class
diff --git a/src/main/java/org/codehaus/groovy/vmplugin/v8/Java8.java b/src/main/java/org/codehaus/groovy/vmplugin/v8/Java8.java
index b9e93f2..cf015f3 100644
--- a/src/main/java/org/codehaus/groovy/vmplugin/v8/Java8.java
+++ b/src/main/java/org/codehaus/groovy/vmplugin/v8/Java8.java
@@ -69,6 +69,8 @@ import java.lang.reflect.WildcardType;
 import java.security.AccessController;
 import java.security.Permission;
 import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
@@ -622,6 +624,16 @@ public class Java8 implements VMPlugin {
     }
 
     @Override
+    public <T> T doPrivileged(PrivilegedAction<T> action) {
+        return AccessController.doPrivileged(action);
+    }
+
+    @Override
+    public <T> T doPrivileged(PrivilegedExceptionAction<T> action) throws PrivilegedActionException {
+        return AccessController.doPrivileged(action);
+    }
+
+    @Override
     public MetaMethod transformMetaMethod(final MetaClass metaClass, final MetaMethod metaMethod, final Class<?> caller) {
         return metaMethod;
     }
diff --git a/src/test/groovy/security/SecurityTest.java b/src/test/groovy/security/SecurityTest.java
index cae37ec..53c51db 100644
--- a/src/test/groovy/security/SecurityTest.java
+++ b/src/test/groovy/security/SecurityTest.java
@@ -20,12 +20,12 @@ package groovy.security;
 
 import groovy.lang.GroovyCodeSource;
 import org.codehaus.groovy.control.CompilationFailedException;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.junit.Ignore;
 
 import java.io.File;
 import java.io.IOException;
 import java.net.URL;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.security.Security;
 import java.util.PropertyPermission;
@@ -63,7 +63,7 @@ public class SecurityTest extends SecurityTestSupport {
         // Use our privileged access in order to prevent checks lower in the call stack.  Otherwise we would have
         // to grant access to IDE unit test runners and unit test libs.  We only care about testing the call stack
         // higher upstream from this point of execution.
-        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
             Security.setProperty("package.access", "javax.print");
             return null;
         });
diff --git a/src/test/groovy/security/SecurityTestSupport.java b/src/test/groovy/security/SecurityTestSupport.java
index be33f9f..719c621 100644
--- a/src/test/groovy/security/SecurityTestSupport.java
+++ b/src/test/groovy/security/SecurityTestSupport.java
@@ -29,12 +29,12 @@ import junit.framework.TestResult;
 import junit.framework.TestSuite;
 import junit.textui.ResultPrinter;
 import org.codehaus.groovy.runtime.InvokerHelper;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
 import java.io.PrintStream;
 import java.security.AccessControlException;
-import java.security.AccessController;
 import java.security.Permission;
 import java.security.Policy;
 import java.security.PrivilegedAction;
@@ -92,7 +92,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
     }
 
     protected GroovyClassLoader loader =
-            AccessController.doPrivileged(
+            VMPluginFactory.getPlugin().doPrivileged(
                     (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(SecurityTestSupport.class.getClassLoader())
             );
 
@@ -132,7 +132,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
             }
         }
         currentClassLoader = Thread.currentThread().getContextClassLoader();
-        AccessController.doPrivileged((PrivilegedAction) () -> {
+        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction) () -> {
             Thread.currentThread().setUncaughtExceptionHandler(new Thread.UncaughtExceptionHandler() {
                 @Override
                 public void uncaughtException(Thread t, Throwable e) {
@@ -145,7 +145,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
     }
 
     protected void tearDown() {
-        AccessController.doPrivileged((PrivilegedAction) () -> {
+        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction) () -> {
             System.setSecurityManager(securityManager);
             Thread.currentThread().setContextClassLoader(currentClassLoader);
             return null;
@@ -271,7 +271,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
         // Use our privileged access in order to prevent checks lower in the call stack.  Otherwise we would have
         // to grant access to IDE unit test runners and unit test libs.  We only care about testing the call stack
         // higher upstream from this point of execution.
-        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
             GroovyCodeSource gcs = null;
             try {
                 gcs = new GroovyCodeSource(file);
@@ -296,7 +296,7 @@ public abstract class SecurityTestSupport extends GroovyTestCase {
         // Use our privileged access in order to prevent checks lower in the call stack.  Otherwise we would have
         // to grant access to IDE unit test runners and unit test libs.  We only care about testing the call stack
         // higher upstream from this point of execution.
-        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+        VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<Void>) () -> {
             parseAndExecute(new GroovyCodeSource(scriptStr, generateClassName(), effectiveCodeBase), missingPermission);
             return null;
         });
diff --git a/src/test/org/apache/groovy/parser/antlr4/TestUtils.groovy b/src/test/org/apache/groovy/parser/antlr4/TestUtils.groovy
index c8aae4b..125562a 100644
--- a/src/test/org/apache/groovy/parser/antlr4/TestUtils.groovy
+++ b/src/test/org/apache/groovy/parser/antlr4/TestUtils.groovy
@@ -46,8 +46,8 @@ import org.codehaus.groovy.control.ParserPlugin
 import org.codehaus.groovy.control.ParserPluginFactory
 import org.codehaus.groovy.control.SourceUnit
 import org.codehaus.groovy.syntax.Token
+import org.codehaus.groovy.vmplugin.VMPluginFactory
 
-import java.security.AccessController
 import java.security.PrivilegedAction
 import java.util.zip.ZipEntry
 import java.util.zip.ZipFile
@@ -222,7 +222,7 @@ final class TestUtils {
     }
 
     private static ModuleNode buildAST(File sourceFile, CompilerConfiguration config) {
-        def loader = AccessController.doPrivileged({ ->
+        def loader = VMPluginFactory.getPlugin().doPrivileged({ ->
             new GroovyClassLoader()
         } as PrivilegedAction<GroovyClassLoader>)
 
@@ -242,7 +242,7 @@ final class TestUtils {
     }
 
     private static ModuleNode buildAST(String sourceText, CompilerConfiguration config) {
-        def loader = AccessController.doPrivileged({ ->
+        def loader = VMPluginFactory.getPlugin().doPrivileged({ ->
             new GroovyClassLoader()
         } as PrivilegedAction<GroovyClassLoader>)
 
diff --git a/src/testFixtures/groovy/org/codehaus/groovy/classgen/TestSupport.java b/src/testFixtures/groovy/org/codehaus/groovy/classgen/TestSupport.java
index 0c3705d..dfb16f7 100644
--- a/src/testFixtures/groovy/org/codehaus/groovy/classgen/TestSupport.java
+++ b/src/testFixtures/groovy/org/codehaus/groovy/classgen/TestSupport.java
@@ -34,6 +34,7 @@ import org.codehaus.groovy.ast.expr.MethodCallExpression;
 import org.codehaus.groovy.ast.stmt.ExpressionStatement;
 import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.runtime.InvokerHelper;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.junit.Ignore;
 import org.objectweb.asm.Opcodes;
 
@@ -44,7 +45,6 @@ import java.io.File;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -58,7 +58,7 @@ public class TestSupport extends GroovyTestCase implements Opcodes {
     // ClassLoader parentLoader = Thread.currentThread().getContextClassLoader();
     final ClassLoader parentLoader = getClass().getClassLoader();
     protected final GroovyClassLoader loader =
-            AccessController.doPrivileged(
+            VMPluginFactory.getPlugin().doPrivileged(
                     (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader)
             );
     final CompileUnit unit = new CompileUnit(loader, new CompilerConfiguration());
@@ -147,7 +147,7 @@ public class TestSupport extends GroovyTestCase implements Opcodes {
     protected void assertScript(final String text, final String scriptName) throws Exception {
         log.info("About to execute script");
         log.info(text);
-        GroovyCodeSource gcs = AccessController.doPrivileged(
+        GroovyCodeSource gcs = VMPluginFactory.getPlugin().doPrivileged(
                 (PrivilegedAction<GroovyCodeSource>) () -> new GroovyCodeSource(text, scriptName, "/groovy/testSupport")
         );
         Class groovyClass = loader.parseClass(gcs);
diff --git a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/CompileTaskSupport.java b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/CompileTaskSupport.java
index 56ba694..24523c3 100644
--- a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/CompileTaskSupport.java
+++ b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/CompileTaskSupport.java
@@ -26,11 +26,11 @@ import org.apache.tools.ant.types.Path;
 import org.apache.tools.ant.types.Reference;
 import org.codehaus.groovy.control.CompilerConfiguration;
 import org.codehaus.groovy.tools.ErrorReporter;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.PrintWriter;
 import java.io.Writer;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -136,7 +136,7 @@ public abstract class CompileTaskSupport
 
     protected GroovyClassLoader createClassLoader() {
         GroovyClassLoader gcl =
-                AccessController.doPrivileged(
+                VMPluginFactory.getPlugin().doPrivileged(
                         (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(ClassLoader.getSystemClassLoader(), config));
 
         Path path = getClasspath();
diff --git a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovy.java b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovy.java
index 7ab8034..940b9f2 100644
--- a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovy.java
+++ b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovy.java
@@ -46,6 +46,7 @@ import org.codehaus.groovy.reflection.ReflectionUtils;
 import org.codehaus.groovy.runtime.InvokerHelper;
 import org.codehaus.groovy.runtime.ResourceGroovyMethods;
 import org.codehaus.groovy.tools.ErrorReporter;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.BufferedInputStream;
 import java.io.BufferedOutputStream;
@@ -62,7 +63,6 @@ import java.io.Reader;
 import java.io.Writer;
 import java.lang.reflect.Field;
 import java.nio.charset.Charset;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.List;
 import java.util.Vector;
@@ -560,7 +560,7 @@ public class Groovy extends Java {
 
         final String scriptName = computeScriptName();
         final GroovyClassLoader classLoader =
-                AccessController.doPrivileged(
+                VMPluginFactory.getPlugin().doPrivileged(
                         (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(baseClassLoader));
         addClassPathes(classLoader);
         configureCompiler();
diff --git a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovyc.java b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovyc.java
index 64dc16f..76a6861 100644
--- a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovyc.java
+++ b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/Groovyc.java
@@ -42,6 +42,7 @@ import org.codehaus.groovy.runtime.DefaultGroovyStaticMethods;
 import org.codehaus.groovy.tools.ErrorReporter;
 import org.codehaus.groovy.tools.FileSystemCompiler;
 import org.codehaus.groovy.tools.javac.JavaAwareCompilationUnit;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 import org.objectweb.asm.ClassVisitor;
 import picocli.CommandLine;
 
@@ -53,7 +54,6 @@ import java.io.Writer;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.nio.charset.Charset;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -1443,7 +1443,7 @@ public class Groovyc extends MatchingTask {
             }
         }
 
-        GroovyClassLoader groovyLoader = AccessController.doPrivileged(
+        GroovyClassLoader groovyLoader = VMPluginFactory.getPlugin().doPrivileged(
                 (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(loader, configuration));
         if (!forceLookupUnnamedFiles) {
             // in normal case we don't need to do script lookups
diff --git a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/RootLoaderRef.java b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/RootLoaderRef.java
index a8d96b0..247c34c 100644
--- a/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/RootLoaderRef.java
+++ b/subprojects/groovy-ant/src/main/java/org/codehaus/groovy/ant/RootLoaderRef.java
@@ -26,8 +26,8 @@ import org.apache.tools.ant.types.Path;
 import org.apache.tools.ant.types.Reference;
 import org.codehaus.groovy.tools.LoaderConfiguration;
 import org.codehaus.groovy.tools.RootLoader;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -88,7 +88,7 @@ public class RootLoaderRef extends MatchingTask {
             }
             lc.addFile(s);
         }
-        AntClassLoader loader = AccessController.doPrivileged((PrivilegedAction<AntClassLoader>) () -> new AntClassLoader(new RootLoader(lc), true));
+        AntClassLoader loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<AntClassLoader>) () -> new AntClassLoader(new RootLoader(lc), true));
         project.addReference(name, loader);
     }
 
diff --git a/subprojects/groovy-console/src/main/groovy/groovy/console/ui/Console.groovy b/subprojects/groovy-console/src/main/groovy/groovy/console/ui/Console.groovy
index 1cdfd46..81c12c3 100644
--- a/subprojects/groovy-console/src/main/groovy/groovy/console/ui/Console.groovy
+++ b/subprojects/groovy-console/src/main/groovy/groovy/console/ui/Console.groovy
@@ -60,7 +60,6 @@ import org.codehaus.groovy.vmplugin.VMPluginFactory
 
 import javax.swing.Action
 import javax.swing.Icon
-import javax.swing.JApplet
 import javax.swing.JFileChooser
 import javax.swing.JFrame
 import javax.swing.JLabel
@@ -415,19 +414,6 @@ class Console implements CaretListener, HyperlinkListener, ComponentListener, Fo
         run(frameConsoleDelegates)
     }
 
-    @Deprecated
-    void run(JApplet applet) {
-        run([
-                rootContainerDelegate: {
-                    containingWindows += SwingUtilities.getRoot(applet.getParent())
-                    applet
-                },
-                menuBarDelegate      : { arg ->
-                    current.JMenuBar = build(arg)
-                }
-        ])
-    }
-
     void run(Map defaults) {
 
         swing = new SwingBuilder()
diff --git a/subprojects/groovy-console/src/main/groovy/groovy/console/ui/text/StructuredSyntaxResources.java b/subprojects/groovy-console/src/main/groovy/groovy/console/ui/text/StructuredSyntaxResources.java
index 17a2f99..48add96 100644
--- a/subprojects/groovy-console/src/main/groovy/groovy/console/ui/text/StructuredSyntaxResources.java
+++ b/subprojects/groovy-console/src/main/groovy/groovy/console/ui/text/StructuredSyntaxResources.java
@@ -18,12 +18,13 @@
  */
 package groovy.console.ui.text;
 
-import java.awt.*;
+import java.awt.AWTPermission;
+import java.awt.Font;
+import java.awt.Toolkit;
 import java.awt.datatransfer.Clipboard;
 
 /**
- * Contains all the basic resources and values used by the utility frame work
- * framework.
+ * Contains all the basic resources and values used by the utility framework.
  */
 public final class StructuredSyntaxResources {
 
@@ -31,26 +32,29 @@ public final class StructuredSyntaxResources {
     // ClipBoard
     // ==================================================
 
-    public static final Clipboard SYSTEM_CLIPBOARD;
-    static {
-        Clipboard systemClipboard = null;
+    public static final Clipboard SYSTEM_CLIPBOARD = getSystemOrAppLevelClipboard();
+
+    private static Clipboard getSystemOrAppLevelClipboard() {
+        Clipboard systemClipboard = getSystemClipboard();
+        if (systemClipboard == null) {
+            systemClipboard = new Clipboard("UIResourceMgr");
+        }
+        return systemClipboard;
+    }
+
+    private static Clipboard getSystemClipboard() {
         try {
-            // if we don't have access to the system clipboard, will throw
-            // a security exception
+            // if we don't have access to the system clipboard, will throw a security exception
             SecurityManager mgr = System.getSecurityManager();
             if (mgr != null) {
                 mgr.checkPermission(new AWTPermission("accessClipboard"));
             }
-            systemClipboard = Toolkit.getDefaultToolkit().getSystemClipboard();
-        }
-        catch (SecurityException e) {
-            // means we can't get to system clipboard, so create app level one
-            systemClipboard = new Clipboard("UIResourceMgr");
+            return Toolkit.getDefaultToolkit().getSystemClipboard();
         }
         catch (Exception e) {
-            e.printStackTrace();
+            // means we can't get to system clipboard
+            return null;
         }
-        SYSTEM_CLIPBOARD = systemClipboard;
     }
 
     // =====================================================
diff --git a/subprojects/groovy-jsr223/src/main/java/org/codehaus/groovy/jsr223/GroovyScriptEngineImpl.java b/subprojects/groovy-jsr223/src/main/java/org/codehaus/groovy/jsr223/GroovyScriptEngineImpl.java
index 540a155..8de6304 100644
--- a/subprojects/groovy-jsr223/src/main/java/org/codehaus/groovy/jsr223/GroovyScriptEngineImpl.java
+++ b/subprojects/groovy-jsr223/src/main/java/org/codehaus/groovy/jsr223/GroovyScriptEngineImpl.java
@@ -62,6 +62,7 @@ import org.codehaus.groovy.runtime.MetaClassHelper;
 import org.codehaus.groovy.runtime.MethodClosure;
 import org.codehaus.groovy.util.ManagedConcurrentValueMap;
 import org.codehaus.groovy.util.ReferenceBundle;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import javax.script.AbstractScriptEngine;
 import javax.script.Bindings;
@@ -79,7 +80,6 @@ import java.io.Reader;
 import java.io.Writer;
 import java.lang.reflect.Method;
 import java.lang.reflect.Proxy;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
 /**
@@ -109,7 +109,7 @@ public class GroovyScriptEngineImpl extends AbstractScriptEngine implements Comp
     }
 
     public GroovyScriptEngineImpl() {
-        this(AccessController.doPrivileged(new PrivilegedAction<GroovyClassLoader>() {
+        this(VMPluginFactory.getPlugin().doPrivileged(new PrivilegedAction<GroovyClassLoader>() {
             @Override
             public GroovyClassLoader run() {
                 return new GroovyClassLoader(getParentLoader(), new CompilerConfiguration(CompilerConfiguration.DEFAULT));
diff --git a/subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java b/subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java
index a43db7a..5186bef 100644
--- a/subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java
+++ b/subprojects/groovy-sql/src/main/java/groovy/sql/Sql.java
@@ -26,10 +26,10 @@ import groovy.transform.NamedParam;
 import groovy.transform.stc.ClosureParams;
 import groovy.transform.stc.SimpleType;
 import org.codehaus.groovy.runtime.InvokerHelper;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import javax.sql.DataSource;
 
-import java.security.AccessController;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 import java.sql.CallableStatement;
@@ -4269,7 +4269,7 @@ public class Sql implements AutoCloseable {
             // read, and the policy shouldn't have to list them all.
             Connection con;
             try {
-                con = AccessController.doPrivileged(new PrivilegedExceptionAction<Connection>() {
+                con = VMPluginFactory.getPlugin().doPrivileged(new PrivilegedExceptionAction<Connection>() {
                     @Override
                     public Connection run() throws SQLException {
                         return dataSource.getConnection();
diff --git a/subprojects/groovy-swing/src/main/java/org/apache/groovy/swing/binding/ClosureTriggerBinding.java b/subprojects/groovy-swing/src/main/java/org/apache/groovy/swing/binding/ClosureTriggerBinding.java
index 44b6905..4f6cce1 100644
--- a/subprojects/groovy-swing/src/main/java/org/apache/groovy/swing/binding/ClosureTriggerBinding.java
+++ b/subprojects/groovy-swing/src/main/java/org/apache/groovy/swing/binding/ClosureTriggerBinding.java
@@ -22,6 +22,7 @@ import groovy.lang.Closure;
 import groovy.lang.GroovyObjectSupport;
 import groovy.lang.Reference;
 import org.codehaus.groovy.reflection.ReflectionUtils;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.lang.reflect.AccessibleObject;
 import java.lang.reflect.Constructor;
@@ -72,7 +73,7 @@ public class ClosureTriggerBinding implements TriggerBinding, SourceBinding {
             final Class closureClass = closure.getClass();
 
             // do in privileged block since we may be looking at private stuff
-            Closure closureLocalCopy = java.security.AccessController.doPrivileged(new PrivilegedAction<Closure>() {
+            Closure closureLocalCopy = VMPluginFactory.getPlugin().doPrivileged(new PrivilegedAction<Closure>() {
                 @Override
                 public Closure run() {
                     // assume closures have only 1 constructor, of the form (Object, Reference*)
diff --git a/subprojects/groovy-templates/src/main/groovy/groovy/text/GStringTemplateEngine.java b/subprojects/groovy-templates/src/main/groovy/groovy/text/GStringTemplateEngine.java
index 894d1a4..de8e47c 100644
--- a/subprojects/groovy-templates/src/main/groovy/groovy/text/GStringTemplateEngine.java
+++ b/subprojects/groovy-templates/src/main/groovy/groovy/text/GStringTemplateEngine.java
@@ -27,11 +27,11 @@ import groovy.lang.GroovyRuntimeException;
 import groovy.lang.Writable;
 import org.apache.groovy.util.SystemUtil;
 import org.codehaus.groovy.control.CompilationFailedException;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.IOException;
 import java.io.Reader;
 import java.lang.reflect.InvocationTargetException;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -193,7 +193,7 @@ public class GStringTemplateEngine extends TemplateEngine {
             final GroovyClassLoader loader =
                     reuseClassLoader && parentLoader instanceof GroovyClassLoader
                             ? (GroovyClassLoader) parentLoader
-                            : AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
+                            : VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
             final Class groovyClass;
             try {
                 groovyClass = loader.parseClass(new GroovyCodeSource(templateExpressions.toString(), "GStringTemplateScript" + counter.incrementAndGet() + ".groovy", "x"));
diff --git a/subprojects/groovy-templates/src/main/groovy/groovy/text/StreamingTemplateEngine.java b/subprojects/groovy-templates/src/main/groovy/groovy/text/StreamingTemplateEngine.java
index ef13858..6ec55f6 100644
--- a/subprojects/groovy-templates/src/main/groovy/groovy/text/StreamingTemplateEngine.java
+++ b/subprojects/groovy-templates/src/main/groovy/groovy/text/StreamingTemplateEngine.java
@@ -32,13 +32,13 @@ import org.codehaus.groovy.control.messages.Message;
 import org.codehaus.groovy.control.messages.SyntaxErrorMessage;
 import org.codehaus.groovy.runtime.StackTraceUtils;
 import org.codehaus.groovy.syntax.SyntaxException;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.IOException;
 import java.io.LineNumberReader;
 import java.io.Reader;
 import java.io.StringReader;
 import java.lang.reflect.InvocationTargetException;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.List;
@@ -597,7 +597,7 @@ public class StreamingTemplateEngine extends TemplateEngine {
         }
 
         private Closure createTemplateClosure(List<StringSection> sections, final ClassLoader parentLoader, StringBuilder target) throws ClassNotFoundException {
-            final GroovyClassLoader loader = AccessController.doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
+            final GroovyClassLoader loader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(parentLoader));
             final Class groovyClass;
             try {
                 groovyClass = loader.parseClass(new GroovyCodeSource(target.toString(), TEMPLATE_SCRIPT_PREFIX + counter.incrementAndGet() + ".groovy", "x"));
diff --git a/subprojects/groovy-templates/src/main/groovy/groovy/text/markup/MarkupTemplateEngine.java b/subprojects/groovy-templates/src/main/groovy/groovy/text/markup/MarkupTemplateEngine.java
index abbbd0e..9317bf1 100644
--- a/subprojects/groovy-templates/src/main/groovy/groovy/text/markup/MarkupTemplateEngine.java
+++ b/subprojects/groovy-templates/src/main/groovy/groovy/text/markup/MarkupTemplateEngine.java
@@ -35,6 +35,7 @@ import org.codehaus.groovy.control.SourceUnit;
 import org.codehaus.groovy.control.customizers.ASTTransformationCustomizer;
 import org.codehaus.groovy.control.customizers.CompilationCustomizer;
 import org.codehaus.groovy.runtime.DefaultGroovyMethods;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
@@ -43,7 +44,6 @@ import java.io.StringReader;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLClassLoader;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.Collections;
 import java.util.LinkedHashMap;
@@ -101,7 +101,7 @@ public class MarkupTemplateEngine extends TemplateEngine {
                     }
             );
         }
-        groovyClassLoader = AccessController.doPrivileged((PrivilegedAction<TemplateGroovyClassLoader>) () -> new TemplateGroovyClassLoader(parentLoader, compilerConfiguration));
+        groovyClassLoader = VMPluginFactory.getPlugin().doPrivileged((PrivilegedAction<TemplateGroovyClassLoader>) () -> new TemplateGroovyClassLoader(parentLoader, compilerConfiguration));
         if (DEBUG_BYTECODE) {
             compilerConfiguration.setBytecodePostprocessor(BytecodeDumper.STANDARD_ERR);
         }
@@ -116,7 +116,7 @@ public class MarkupTemplateEngine extends TemplateEngine {
      * @param tplConfig         template engine configuration
      */
     public MarkupTemplateEngine(final ClassLoader parentLoader, final File templateDirectory, TemplateConfiguration tplConfig) {
-        this(AccessController.doPrivileged(
+        this(VMPluginFactory.getPlugin().doPrivileged(
                 new PrivilegedAction<URLClassLoader>() {
                     @Override
                     public URLClassLoader run() {
diff --git a/subprojects/groovy-test/src/main/java/groovy/test/AllTestSuite.java b/subprojects/groovy-test/src/main/java/groovy/test/AllTestSuite.java
index 757be72..a9b8002 100644
--- a/subprojects/groovy-test/src/main/java/groovy/test/AllTestSuite.java
+++ b/subprojects/groovy-test/src/main/java/groovy/test/AllTestSuite.java
@@ -26,10 +26,10 @@ import junit.framework.TestCase;
 import junit.framework.TestSuite;
 import org.codehaus.groovy.control.CompilationFailedException;
 import org.apache.groovy.test.ScriptTestAdapter;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
 import java.io.IOException;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 import java.util.List;
 import java.util.logging.Logger;
@@ -78,7 +78,7 @@ public class AllTestSuite extends TestSuite {
     private static final Logger LOG = Logger.getLogger(AllTestSuite.class.getName());
     private static final ClassLoader JAVA_LOADER = AllTestSuite.class.getClassLoader();
     private static final GroovyClassLoader GROOVY_LOADER =
-            AccessController.doPrivileged(
+            VMPluginFactory.getPlugin().doPrivileged(
                     (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(JAVA_LOADER)
             );
 
diff --git a/subprojects/groovy-test/src/main/java/groovy/test/GroovyTestSuite.java b/subprojects/groovy-test/src/main/java/groovy/test/GroovyTestSuite.java
index f7322a8..1d3921b 100644
--- a/subprojects/groovy-test/src/main/java/groovy/test/GroovyTestSuite.java
+++ b/subprojects/groovy-test/src/main/java/groovy/test/GroovyTestSuite.java
@@ -24,12 +24,11 @@ import junit.framework.Test;
 import junit.framework.TestSuite;
 import junit.textui.TestRunner;
 import org.apache.groovy.test.ScriptTestAdapter;
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
 
 import java.io.File;
-import java.security.AccessController;
 import java.security.PrivilegedAction;
 
-
 /**
  * A TestSuite which will run a Groovy unit test case inside any Java IDE
  * either as a unit test case or as an application.
@@ -51,7 +50,7 @@ public class GroovyTestSuite extends TestSuite {
     protected static String file = null;
 
     protected final GroovyClassLoader loader =
-            AccessController.doPrivileged(
+            VMPluginFactory.getPlugin().doPrivileged(
                     (PrivilegedAction<GroovyClassLoader>) () -> new GroovyClassLoader(GroovyTestSuite.class.getClassLoader())
             );
 
diff --git a/subprojects/groovy-xml/src/main/java/groovy/xml/FactorySupport.java b/subprojects/groovy-xml/src/main/java/groovy/xml/FactorySupport.java
index a6d57c7..7066362 100644
--- a/subprojects/groovy-xml/src/main/java/groovy/xml/FactorySupport.java
+++ b/subprojects/groovy-xml/src/main/java/groovy/xml/FactorySupport.java
@@ -18,10 +18,11 @@
  */
 package groovy.xml;
 
+import org.codehaus.groovy.vmplugin.VMPluginFactory;
+
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParserFactory;
-import java.security.AccessController;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
 
@@ -32,7 +33,7 @@ public class FactorySupport {
     static Object createFactory(PrivilegedExceptionAction action) throws ParserConfigurationException {
         Object factory;
         try {
-            factory = AccessController.doPrivileged(action);
+            factory = VMPluginFactory.getPlugin().doPrivileged(action);
         } catch (PrivilegedActionException pae) {
             Exception e = pae.getException();
             if (e instanceof ParserConfigurationException) {